This is research software (see the disclaimer in README.md), but we still want to know about vulnerabilities.

Please report security issues privately rather than opening a public GitHub issue, using GitHub's private vulnerability reporting for this repository. Include what you found, how to reproduce it, and its potential impact if known.

This is a small, largely solo-maintained research project, so there's no formal SLA — but we'll acknowledge reports and work through them as soon as we can.